will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Route runner daemon through nginx CF Access proxy

Browse Source 
act_runner cannot inject custom HTTP headers, so CF Access blocks its
unauthenticated calls to git.neuralplatform.ai. Add a gitea-proxy
deployment (nginx:alpine) in the ci namespace that injects the CF
Access service-token headers and proxies to https://git.neuralplatform.ai.

Both runner secrets now point GITEA_INSTANCE_URL at the in-cluster proxy
(http://gitea-proxy.ci.svc.cluster.local:3000). Build containers still
clone via SSH through git-ssh-init.sh — unaffected.
This commit is contained in:
Will Anderson
2026-05-05 04:17:52 -05:00
parent ae3257525e
commit 939e66bfbb
3 changed files with 140 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/gitea-runner/external-secrets.yaml
+4 -4
View File
@@ -13,7 +13,7 @@ metadata:
name: gitea-runner-secret
namespace: ci
annotations:
force-sync: "2026-05-05-ssh-clone"
force-sync: "2026-05-05-gitea-proxy"
spec:
refreshInterval: 1h
secretStoreRef:
@@ -24,7 +24,7 @@ spec:
creationPolicy: Owner
template:
data:
GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
GITEA_INSTANCE_URL: "http://gitea-proxy.ci.svc.cluster.local:3000"
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
GITEA_SSH_PRIVATE_KEY: "{{ .ci_ssh_private_key }}"
data:
@@ -44,7 +44,7 @@ metadata:
name: neuron-technologies-runner-secret
namespace: ci
annotations:
force-sync: "2026-05-05-ssh-clone"
force-sync: "2026-05-05-gitea-proxy"
spec:
refreshInterval: 1h
secretStoreRef:
@@ -55,7 +55,7 @@ spec:
creationPolicy: Owner
template:
data:
GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
GITEA_INSTANCE_URL: "http://gitea-proxy.ci.svc.cluster.local:3000"
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
GITEA_SSH_PRIVATE_KEY: "{{ .ci_ssh_private_key }}"
data: